Record converged OpenBao apply and blocked RKE2 bootstrap #51
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/Documentation!51
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/identity-plan-readiness"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Record verified private Terraform plan 72 and specifically approved apply 75 on 2026-10-15. The eight original RKE2 OpenBao resources were applied and the post-apply plan had no managed-resource changes. The promoted library is workflows v1.42.1 at workflow_release_sha 87fb65598184c1a592da4f902bf666097c9b710c, retaining the merged marker/UI-hint corrections from #107/#108. Historical failed runs remain distinguished from this successful apply.
Platform build 4972 published signed rke2-bootstrap-bundle-v0.1.0-r7501. Deployment 4974 verified the release, obtained the bootstrap Kubernetes credential and passed five permission probes, then stopped before deploying the bootstrap with a cleanup HTTP 403 that masked the earlier preflight error. The minimal Terraform self-revocation correction and workflows #109 are prepared, not applied/promoted. The hidden original error remains unresolved until a fresh run reports it.
Reconcile platform, delivery, storage and decisions pages with these verified states. Keep fresh reviewed policy plan/apply, bootstrap acceptance, routine-role issuance, temporary-login retirement, controller/Core/RKE2 deployment and full locking/recovery pending. The unchanged signed bootstrap release can be reused after the reviewed corrections. Public source contains no private repository URLs, credentials, raw plans or provider output.
Validation at
9aec8ca584: npm run check, default npm run build, native staged Gitleaks 8.30.1 and diff checks passed. This is documentation only; it neither dispatches a workflow nor changes infrastructure.Reviewed all four changed documentation files at
fda2c79fd0. The identity-plan record distinguishes run 70's eight proposed creates and passing plan guard from run 71's dispatched but unverified apply; workload issuance, convergence, Terraform locking/recovery, and RKE2/Core deployment remain pending. The UDS references document existing gateway ownership and the upgrade boundary; this PR changes no manifests, delivery workflows, routes, or policy. No blocking documentation issue found. The private Terraform run artifacts and live cluster were not independently inspected here, so this approves the documentation/source scope, not operational acceptance. Documentation site and source-security checks were pending at review; required CI must pass before merge.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Record successful identity plan and approved apply dispatchto Record identity plan acceptance and blocked applyReviewed the current four-file documentation head
f622eaeb2fafter the earlier approval atfda2c79. The new text records that private Terraform run 71 rejected a fingerprint mismatch before apply, despite the same eight proposed creates; it distinguishes a mocked UI-hint-order reproduction from inspection of the private live plans and leaves workflows #108 unreleased and a fresh plan/separately approved apply pending. No identity mutation, workload issuance, or RKE2/Core deployment is claimed. UDS gateway ownership remains with the existing tenant/admin routes; this PR adds no manifests, gateway, policy, or deployment caller. No blocking source issue found. Nonblocking documentation note: the storage page's introductory sentence still says 'apply results remain unverified' although its later run-71 section reports the blocked outcome; align that wording when convenient. Private run artifacts and live cluster were not independently inspected in this review. Exact-head Documentation site and source-security checks are pending; this source approval is not operational acceptance or merge clearance.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Reviewed the four changed documentation files at
92d7fa8f2f. The text distinguishes the accepted eight-create plan in private Terraform run 70 from run 71's fingerprint-gate rejection before apply, and limits the five mocked exports to reproducing possible UI-hint ordering rather than claiming inspection of either private plan. It leaves workflows #108's release/promotion, a fresh plan/fingerprint and separately approved apply, identity issuance/convergence, locking/recovery, and RKE2/Core upgrade acceptance pending. Existing tenant/admin UDS gateway ownership is preserved; this documentation head adds no package, policy, route, gateway or deployment caller. No blocking source issue identified. Nonblocking wording note remains: storage-and-recovery's central-runner paragraph says 'apply results remain unverified' although the later section reports the blocked run-71 result; it could say successful apply/convergence remains unverified. The private run artifacts and live cluster were not independently inspected. All exact-head Documentation site and source-security checks are pending; approval of documentation scope is not scan success, operational acceptance or merge clearance.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Reviewed the four changed documentation files at
9aec8ca584. The current text distinguishes the earlier run 71 fingerprint-gate rejection from the later promoted workflows v1.42.1, successful plan 72 and separately approved apply 75 of eight OpenBao identities with a no-managed-change post-apply plan. It records signed RKE2 bootstrap publication and run 4974's credential/permission success but explicitly leaves bootstrap deployment blocked by self-revocation cleanup and an obscured preflight error; the proposed policy and workflow corrections, routine issuance, locking/recovery, and Core/RKE2 upgrades remain pending. The UDS discussion preserves established tenant/admin gateway ownership and distinguishes signed package publication from live installation; this documentation-only PR adds no gateway, route, policy, manifest or deployment caller. No blocking source issue found. Nonblocking documentation note for kiyi: PR title/body still describe run 71 and workflows #108 as the latest state and call successful apply pending; update the PR description to reflect runs 72/75 and run 4974 before merge. Private Terraform/platform artifacts and live cluster were not independently inspected in this documentation review; recorded operational outcomes are not independently accepted here. Exact-head site and source-security checks are pending and remain mandatory merge gates; approval is not a scan verdict or merge authorization.CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.
Record identity plan acceptance and blocked applyto Record converged OpenBao apply and blocked RKE2 bootstrap